Hello everyone in this part. We will talk about the
ARP poison and mitam attacks.
Firstly let's talk about the ARP protocol.
What is ARP protocol Erp
stands for address resolution protocol?
So ARP points the
hardware address of the machine using that IP address
from a non IP address when the IP
which means Internet Protocol has a
datagram or segment to send it has
to inform the hardware address or to
Target in the local network to protocol such
as ethernet at the network layer.
And if IP Internet Protocol
cannot find the hardware address of
the target machine in the cache memory of the
ARP it will use ARP to
search for this information.
So with a specific IP address in
hand ARP queries the local
network. It queries the lock
Network to learn who owns this IP address.
This query is sent to the local network by
broadcast.
Aims to find the MAC address of the machine to reach
the IP address belongs by querying.
ARP operates below the network layer
as a part of the interface between the
OSI Network layer and OSI data
link layer.
So in this part, we will investigate the
network traffic in Wireshark that
I have obtained by performing a real
ARP poisoning mitam attack.
But first let's examine our scenario.
We have two host machines here.
And the first one is running Cali Kali
operating system.
And this is the machine that will do
ARP poison or air peace
proofing attack. The second machine
is a Windows machine. So, this
is our Network topology before Erp poisoning
the IP address of our
Windows machine and with two dot
15.
And to make others and Suite 76
and B6 and there
is a router the IP address
and with 2.1.
So they make address and sweet 35 and
double zero.
As you can see we should focus specifically
on Mac addresses.
Of each one.
We will focus on the Mac addresses.
And we can consider a sewage between them.
As you can guess here windows and Cali machines
go to the Internet through this
router.
So therefore windows and cutting machines
now this interface.
Of the router which is considered as
the default gateway.
In other words, they have the IP address and
Mac address information of this
interface to see this. Let's look at
the ARP cache tables of Windows and Cali
machines in order.
Let's look at the ARP table of Windows first
here. We see the router with the
IP address and with 2.1 in
the first line in here
this line belongs to the rotor
information. So and on
the right side, it is the MAC address.
and sweet 35 and 0
0
as you have seen before on the topology and it
ends with 35 and
0 0 just like we see in the
topology on the bottom line. We see
the IP address of the Kali machine
as you know, and see it
2.4 and in the
other column you can
see it's Mac address and with 64
and 11 and thus
we see that Windows has
information about other machines in our
Network.
first one
is the rotor.
And the second one is the Cali
machine.
So Windows knows that the router
has the IP address ends with
2.1 and the MAC
address ends with 35 and 00.
And also knows that the Cali
machine has the IP address 2.4 and
the MAC address and sweet 64
and 11.
so
these informations are so important
to analyze our network
and to find the some
attack a patterns
on the PK file that we
will show later.
For example vanity Windows machine wants to
send a pink packet to Kylie machine.
The destination IP address of this
packet will be the others ending with 2.4 while
the destination Mac address will be 64 and
11. And now let's look
at the ARP table of the Cali machine.
Here in the first line. We see the record of
the Windows machine the first line belongs
to the Windows machine.
And as the IP address and Suite 2
dot 15 as you
saw in the network topology, the Windows
machine has the IP address and with the
ends with 2.15 and
Kali machine knows that
Windows has this
IP address and also knows that
in its Erp cache
table Windows the MAC
address of the windows. So Windows has the
MAC address and with 76
and B6.
So this is the important point for
us and
And at the bottom line, the routers information
is kept you can see
in here.
and with the IP address
and speed 2.1 this IP
address belongs to the rotor.
So and the MAC address of the
router is this Mac address
and
It ends with 35 and 0
0.
You can see here.
So the Cali machine has the information
about the windows and the
router.
And Kylie knows that win
colonos the windows
IP and making formations
and also it knows
the rotors information about
its IP address and Mac
address. So these were
the ARP cache tables
of the Cali machine and the Windows
machine and now let's go back to topology.
When a message or a network packet is sent
from the Windows machine to the
internet. Let's say this packet
or when there is a network packet
coming from the internet to the
Windows machine.
As you know, the router must know the MAC address
of this Windows machine in order to provide or
in order to provide this traffic or
to forward this packets and
just like the
information of the router in the windows ARP table.
And after the network, the connection
between Windows and routers is
established ARP communication is
already made between them.
So as a result, they have each other's
IP and make mapping or
matching information. So Windows
knows that the IP
and sweet 2.1 belongs
to the neck address
and sweet 35 and
0 0
Windows has this information and fact
like this on the
other hand. The router also knows that
the IP address ends with
2.15 matches with
the 76 matches with
the MAC address and switch 76 and
P6. In other words Erp communication
takes place as like this
Windows machines and ARP broadcast
squaring a who has and Dot
10 Dot
0.2.1.
Tell the IP address of 10
dots 0.2.15.
So since the machine with an
IP address and link with 2.1 in
the network is a router the router
sends an ARP response and
the response packet packet is
like this 10.0 dot
2.1 is at
in the in this Mac
address in this machine and sweet
35 and 0
0 does the IP
address ending with two dot one on
the Windows machine. That is
the gateway address is match fit this
Mac address.
match with this Mac address
and written to the windows Erp
table this information. So
likewise the router creates such
a broadcast to match the IP address
of the Windows machine and
with Mac
address and writes the response to
its own Erp table.
It does IP address and Mac address
matching is made on both sides and the
same communication is done between Cali and
windows as well.
You know that maybe about the
Erp protocol. So
now let's see a similar communication
example in Wireshark.
And in this pickup file, let's type
ARP in display
filter field and filter it
to see the ARP traffic.
So let's look at this packet.
the machine with the MAC address ending in
six e and BD is
sending a broadcast you can
see that we can understand that is broadcasting because
the destination Mac address consists of
FF characters. So
in this broadcast it asks,
who is the machine whose
IP address and sweet 1.1?
and asks it to report it to
the
IP address and link with the one thought
two
It asks it to report to the
IP address ending with 1.2 the
machine whose Mac address and
Suite.
In the next packet the machine
whose Mac address ends with 30 for
and 56. So
response to this
query the previous query
to the previous query with the
RP reply message you can
see it is a reply message and
it replies to the
to the previous query.
About the IP address and
with 1.1.
And in the reply of 34 56,
it says that the
IP address ends with 1.1 belongs
to me.
So it knows now that
this IP address belongs to
this machine.
That has the MAC address and
with 34 and 56 and
it was a simple
and usual example of Erp communication.
Now we can close this pickup
file. Now. Let's see a huge internet
traffic on our topology and
I have captured before
in Wireshark and normal a
usual internet traffic and we
will look at our machines internet traffic
in Wireshark. So let's open the peak
file that I have captured before.
and in this pickup file
Let's look at a normal usual internet
traffic example.
So for example, let's look at this packet.
The IP address ending with
two Dot 4 belong
to the Cali machine, you know,
the calcium sense a
TCP packet to the
IP address and Suite 237
and
2309.
That is to an address outside
the network on the internet. However, when
we look at the destination Mac address
in this packet
Let's look at the packet details.
in this packet
when we look at the destination Mac address
we can see.
the destination Mac address and with
35 and 0
0
so this address is the MAC address
of the router.
And therefore it sends
this packet to the router to send the
packet to the address to 37
to 39. The
router will receive this packet
and forward it to the destination IP
address.
And if we hadn't look
at the destination Mac address, we wouldn't
have noticed this detail. We will
understand better. How important this detail
is when we look again after ARP poisoning.
Okay, and this is
how to dot for
the color machine send the
packet to the destination over the
rotor.
Now, let's look at the next packet when we
look at the next packet. This packet
comes from the IP address and
with 237 and
239 and this IP
address belongs to the previous Target
others on the internet. Now the
packet comes from this IP
address and an application data packet
is coming to two dot
four from two thirty
seven, two thirty nine
Source IP address, but if you look
at the mechanics,
Of the source IP address we see
that it ends with a 35
and 0 0.
But this address is the MAC address
of the router. Yes, because the packet from
the coming incoming
packet from this IP address Arise at
the router first and router
forwards this pack
to the IP address with
two dot for which
is which belongs to the Kylie machine
and the destination machine is Kelly
with ip2.4. You
can see that the MAC address
and sweet.
64 and 11. So the
destination is really Cali machine and this
is the expected and normal internet traffic.
And now let's talk about how an Erp
poisoning or mitm attack
happens Carly is
our attacker machine will be
our attacker machine.
Let's look at the on our topology and
Kali machine will be our middleman and
Kelly will stand between
the Windows machine and
the router.
In the Erp poisoning attack or
mitmen in the middle attack. Kali
will turn
to the rotor and say hey, I
am the mission with the IP 2.15.
So it will send an ARP reply message like
this 2.15 is
at the MAC address 64 and
11 to the rotor. So which
64 11 is
its neck address?
With this message, the router will match the
IP address ending with two dot
15 vitically Mac
address.
In its ARP table the IP
address 2.15 will
match with the MAC address of Kali.
The second target of the Kali
is the Windows machine in The Next Step. Kali
will turn to the Windows machine.
And it will send an Erp
reply message directly and
it will say this. Hey, I
am the mission with the IP address
2.1.
So it will send an air purify
message to dot one
IP address is at the
MAC address.
64 and 11
so windows will think Cali is
a router.
And it will send packets to the Kali.
That it should send to the rotor.
You can imagine this situation like this Windows once
to send a packet a
message.
or packet to the internet for example,
and firstly it will
send the packet to the router in a
normal traffic, but now
As a result as a
result of the Erp poisoning Windows things
the Cali machine as rooted. So
when the when when
it wants to send the
packet to the rotor.
It will send to the Cali because in the
ARP table of Windows the
Mac the IP
address to ends with 2.1 matches
with the MAC
address.
64 and 11
So when it wants to send a packet to the router,
it will send the packet
to this Mac address.
Because it believes that the IP
address matches with this Mac
address, but this Mac address belongs to
Cali machine.
So when it sends a packet to this
IP address.
To send the packet to this Mac
address.
So to the Kali machine, so as a
result packets going to
router from the windows.
And coming from the
router to Windows machine.
We'll go to the Cali.
Let's say this packet going from the
windows to the router.
This packet will go to the Cali.
As to result of the ARP poison and the
packets coming from the router to
the Windows machine.
Let's say this these packets
will go to the Kali.
Because the router thinks that the IP
address 2.15 matches
with the MAC address
64 and 11.
So in the ARP table of root
for the MAC address, sorry the
IP address 2.15 matches
with the MAC address.
64 and 11
and when a packet
comes from the internet to the windows the
router will forward the packet.
To this IP address and in its
RP table this IP
address matches with the Cali's Mac
address. It will send packet to
this method so
to the Cali machine.
On the other hand Kali will forward traffic as
it should.
Because Kelly receives packets from the
router and forwards them to Windows.
And when the Cali receives when
the color receives the packets
from the windows.
It will forward the packets to the rotor.
And in this situation there is no problem or interruption in
network traffic. So this
will become nearly impossible
to monetize that unusual
situation that the Erp
poisoning attack and let's
take a look at what happens during
Erp poisoning and how
traffic is manipulated afterwards in Wireshark.
So let's open the
pickup file associated with Erp poisoning.
And men in the middle attack.
so we have opened the pickup
file associated with the RP poisoning and
in this traffic includes all
packets from the moment ARP poisoning
started and
here the first thing
that takes our attention is there.
Firstly let's remember our machines with their
Mac address in here.
You can see the machine as
the MAC address
and Suite 76 and P6.
And this is our Windows machine.
Maybe you can remember from the
topology the MAC address 76 and
P6 belongs to Windows machine.
So when we see this Mac address,
they will know that this is the windows.
and when we see the MAC address 35
and 0 0
we will know that this is the router and when
we see the MAC address 64 and
11, we will know that this machine
is currently so let's
turn back to the pickup file.
And now you can see that in here
the first packet associated
with ARP in
this packet. The
source Mac address is the
At the source Mac address is kali's Mac
address 64 and
11 and the other Mac address
belongs to Windows. So Source
machine is the Kali and
destination machine is Windows. Let's
focused in that situation.
The first packet is a ARP
reply message ARP reply
packet, although there is no ARP request
from Windows machine
76 and ps6 Cali
Sands
reply ARP reply
message directly and
moreover. He says that the
IP ending with
two dot one.
belongs to it belongs to
its own others
or it says that the IP
address 2.1 is
mine mine and
my IP address.
So it says to Windows.
It says Kelly says to Windows. I am
the router it is reply message.
And then even if
we don't know which machine
the MAC address and link with 64 and
11 belong belongs
to it is not normal for
machine to send an ARP reply message
directly in this way. Since there is no mechanist
change on the router if we compare
this Mac address with the routers Mac
address.
We can be sure that it is a different machine.
So right after the machine with
the 64 and 11 cents a
message another another reply Erp
reply message to 35
and 0
0 and you know, this Mac address
belongs to the router.
You can see in here.
Smack address belongs to the rotor. So it
means that Kylie sends
a reply ARP reply
packet ARP reply message
to the router.
And what he says in his reply message.
He says that 2.15 the
IP address ends with
two dot 15 is at
my Mac
address.
Is that color is mechanics?
It says that the IP address and
sweet 2.15 belongs to
me.
and
In this way.
This is again a direct ARP reply
packet. So it says to the router it says
to the router. I am the Windows
machine and it sends these messages over
and over again. You can see that.
These message can be
seen.
Again, so this phase was the ARP poison
and they are people things and after
this step after this step and the
router will think Cali is
Windows.
And windows also will think Cali is
rotor.
So now let's look at the traffic after ARP poisoning
part and let's look
at first packet after ARP poison.
the an application data
a packet goes from the
IP address 2.15 that
we know the windows
as the Windows machine and
to the IP address
and Suite one twenty and
151.
When we look at the packet details, we see
that Mac address.
Associated with this IP address is
76 and
B6.
So let's look at the topology.
As you see this Mac address belongs to
Windows. So in this line
a packet goes from
the Windows machine to this IP
address in a normal
in the normal terms the packets
sourcing from the windows will
go to the router.
To forward the IP address in the
internet, but when we look at
the details, we can
see that the packet sort the
packet sourcing from the windows goes to
the this Mac address and this
Mac address doesn't belong to
the router.
Because the MAC address and sweet 64
and 11 belongs to
Cali.
So the packet comes from
the windows are going
to the Kali machine.
Not not going to the water.
so
we can see the ARP poisoning
in this line.
and now
If we consider on
this packet.
We can visualize this situation like
this.
a packet
goes from Windows to the internet.
and
you know that in the normal terms
under normal terms this packet
should go to the rotor.
But in our situation the packet comes
from Windows are going
to cut a machine.
and because after the Erp
poisoning Windows things that
the IP address of
the rotor belongs to the belongs to
this Mac address and it sends
the packet to the Cali
so
the packet is now on our calcium machine.
in this step
In the next packet we can see a
TCP routines mission.
However, here we see that the same
packet was sent to the
same destination by Kali.
with the IP address of windows
So let's look at we see
in the packet details the source
IP address.
belongs to the windows
as the MAC address
of Kali machine
you can see the IP address of windows, but when
we look at the details, we can see the
MAC address of the Kali. So who sends
the packet the same packet is
the Cali machine actually and you
can see the source Mac address
belongs to the Cali machine, but IP address
can be seen as the
windows IP address.
So in in this situation actually
Kali sends the
same packet to the destination again,
what happens in
this step?
Kali forwards the packet coming from
the Windows machine to the
router.
We can see Kali Sands
packet to the router because the destination
Mac address belongs to the rotor.
So as a result the packets sourcing from
the Kali now and going to
the rotor.
So let's imagine on.
Our topology The Last Action in the
last step. The packet came
from the windows is in
here on the Cali machine now in the
next packet Kali recent and
or forward the packet to
the rotor.
So in this packet, you can
see the IP address as
2.15 but the MAC
address is the cutting machine.
So Source, IP address is 2.15.
but the MAC address
is
Mac address is 64 and
11. So the cutting calories
because the router knows that
the IP address belongs to
the this Mac address.
So you so we are
we are seeing that in the packet The
Source IP address. Is this anti-source
Mac address is this
So that is ARP poisoning or
mitm attack.
So you can also detect ARP poisoning
attacks by examining fire shares
a duplicate IP address detected
running message, so you can see the
message as duplicate IP
address detected for
Or this IP address and Mac address and you
can investigate these messages as
well. So you can also see such
warnings by going to the expert information under
the analyze
menu and expert.
information window you can see
These Warnings
so you can investigate the duplicate IP
address configured warnings in
here. This is
also useful to detect the
some ARP poison illustrations
or another malicious
activities.
And that's it about ARP poisoning
now.
Let's look at the example of
an another attack type about
the ARP. Let's look at
the example of an ARP storm attack so
we can close this PK file
now.
It is an attack type intentionally, correct
by an attacker from within the
local network as well in Erp in
Erp packet storm. The
attacker keeps generating broadcasts.
The over and over again and in the
end it may render the network unable to
carry normal traffic.
That is it can consume all network
resources that are normal sufficient and
IRP and ARP storm
also known as an ARP fluid is
a type of Cyber attack that involves
sanding a large number
of ARP messages to a
device or network in an attempt to
overwhelm to overwhelm it.
So the goal of an Erp storm
attack is to disrupt communication and
potentially cause a denial
of service as you know deals attack or
those those attack by
overall meaning the target
with unnecessary terrific. So
in an ARP storm attack,
the attacker may send a large
number of ARP requests or
replies to do Target devices or
it using either a single Source
or multiple sources the target
May then become overwhelmed with
the volume of traffic and be
unable to process legitimate.
To process legitimate requests disrupting
communication and potentially causing dios.
So ARP
storm attacks can be difficult
to detect and prevent as
the ARP protocol is essential for
communication on a local area network
and it is difficult to distinguish
between legitimate and
malicious traffic. So however, there
are measures that can be to mitigate the
risk of such attacks
such as implementing rate limiting
and filtering rules and using
Arps to proofing detection tools. Also,
maybe let's look at an
example of ARP storm in here
at first glance. We notize
that between 0 and
one second more than
you can see between second zero
and the second one.
in this range
we can see we can notice more than
20 ARP broadcast
packets.
You can see.
These are the ARP broadcast packets.
and
this is definitely not normal in the
next seconds.
in the next seconds
about 70 broadcast packets
continue to be set.
This is an example of Erp store
attack.
So this is an example of ARP storm
attack, and that's all.
So that's all for now. See you on the
next video.